Scan could not complete

If scans are taking too long or appear to be progressing very slowly, consider the following solutions:

Ensure you have sufficient disk space

Run focused scans while your PC is idle

Ensure you have sufficient disk space

Windows Defender Antivirus requires disk space to remove and quarantine malware files. It might be prevented from completely removing a threat if there isn't enough space on your PC, particularly on your system drive (commonly drive C). See the following to help free up space:

Windows Defender Antivirus encounters errors

If Windows Defender Antivirus continually encounters errors during scans or during malware removal, try the following solutions:

If Windows Defender Antivirus encounters an error, we recommend you provide feedback to Microsoft, so we can deliver fixes as fast as possible. By default, Windows automatically collects error information, but describing the error on the Feedback Hub app can help us address the error more efficiently.

To resolve errors immediately, advanced users can look up the error code to check for possible causes and solutions.

Malware is not detected

To detect the latest threats, use a robust antimalware product, like Windows Defender Antivirus, which is built into Windows 10 and Windows 8.1 (read about Microsoft antimalware solutions). Ensure that critical security features are turned on and that Windows Defender Antivirus is fully updated before scanning.

Use Windows Defender Antivirus with cloud-based protection

By default, the following advanced features are enabled. If you’ve turned them off, you should enable them for the best protection:

Make sure the switches for Cloud-delivered protection and Automatic sample submission are set to On.

Cloud-delivered protection and Automatic sample submission turned on

These features significantly increase the chances of detecting never-before-seen malware and enable the automated creation of new protection updates that help immunize all other computers running Windows Defender Antivirus from the newly discovered threats.

Malware keeps coming back

Even after a malware has been removed, it might come back if you visit the website that hosts it or receive it again by email. Avoid websites that might contain malware, such as sites that provide illegal downloads.

In some cases, redetection of the same malware is due to an undetected malware component constantly dropping the detected malware. The malware is typically dropped and redected right after you restart your PC. To resolve this:

Scan with Windows Defender Offline

If the same malware keeps infecting your PC, use Windows Defender Offline to look for and remove recurring malware. Windows Defender Offline is a scanning tool that works outside of Windows, allowing it to catch and clean infections that hide themselves when Windows is running.

NOTE: Before initiating a Windows Defender Offline scan, ensure that you have saved your work. Your PC will restart before starting the scan.

Windows Defender Offline is incorporated in Windows 10. To start an offline scan on Windows 10 version 1703 (Creators Update) or later:

Perform manual cleanup

Some threats can be very persistent, especially if they have elevated privileges. If a Windows Defender Offline scan has been unsuccessful, try a manual cleanup.

NOTE: This process should be performed by experienced users only. You should have backups of critical files before proceeding. If you have limited technical experience, you can choose to reset, restore, or reinstall your PC.

Here are some general steps you can take to manually remove malware:

Close all open applications and stop unnecessary processes. You can use tools like Process Explorer to find and stop running processes.

Remove malware autostart triggers. Autoruns for Windows can list all applications, drivers, and services that autostart, including ones triggered in the registry and by the Task Scheduler.

Check the HOSTS files and ensure that there are no malicious entries that redirect normal network traffic. Reset the HOSTS file if necessary.

Uninstall or delete the malicious application. Most malware do not have uninstallers, so removing them will often involve manually looking for malicious files and deleting these files. Some of these files will be hidden inside unusual locations, like the Recycle Bin.

To understand how to clean specific threats, read about the threat in the threat encyclopedia. Use the name of the threat as detected by Windows Defender Antivirus to search the threat encyclopedia. The threat encyclopedia describes the behavior of major threat families and provides special cleanup instructions for specific situations.

Malware has caused irreversible changes

If malware has caused irreversible changes to your PC, you can try to reset your PC. This might involve restoring data from backup.

Reset, restore, or reinstall your PC

Back up any files and settings you want to keep so that you can restore them later. Windows provides several options on how you can reset or refresh your PC. If you choose to manually reinstall, you will need to prepare installation discs, product keys, and setup files.

NOTE: Whenever possible, restore your files from backups generated before the infection and stored in an external location, such as OneDrive, which provides regular cloud-based backups with version histories. Backups that are on your PC during an infection might have already been modified by the malware.

See the following articles for more information about reinstalling or recovering Windows:

Update software

As soon as you restore your PC, make sure you have the latest software running. The latest versions of software include available fixes of known security issues. This will help ensure your PC is not infected by malware that exploit security vulnerabilities.

See the following articles for more information about updating Microsoft software and third-party applications:

Provide feedback to Microsoft

Microsoft continually works on enhancing the user experience on all current products, including Windows Defender Antivirus. We encourage all customers to make use of the following feedback channels included in Windows 10:

Set Windows to automatically prompt for your feedback. Windows is already configured to automatically prompt for feedback by default. To ensure this feature is turned on, go to Start, then select Settings > Privacy > Feedback & diagnostics. Make sure that Windows is set to ask for your feedback automatically.

Feedback frequency settings

Manually send feedback at any time through the Feedback Hub app. To send feedback, type Feedback Hub in the search bar to open the app. In the app, select Feedback > Add new feedback. Select Security, Privacy, and Accounts > Windows Defender Antivirus as the category.

Submit undetected malware

If you believe Windows Defender Antivirus is not detecting a malicious file, obtain a copy of that file and submit it to us for analysis. We will try our best to quickly review that file and update our solutions as appropriate.